Node ci

Skill Paldom/node-skills/skills/node-ci

Agent Skills for maintaining high-quality open-source Node.js, TypeScript, Next.js, and React apps and packages - linting, type safety, testing, packaging and releases, and CI quality gates.

Install

npx -y skills add Paldom/node-skills --skill node-ci

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Authors GitHub Actions CI for Node projects - version matrices derived from engines, setup-node caching, pnpm setup without corepack, a fail-closed all-checks aggregator, merge_group support, concurrency. Use when the user asks to set up CI, add a Node test matrix, cache installs, or fix required checks and merge queues. Not for release/publish pipelines or dependency-update policy.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.9 KB, as published. Nobody here has run it

node-ci

Authors CI that is derived from the repo, fails closed, and is supply-chain clean by construction. The failures this skill fixes: models hardcode Node versions that drift from engines (or are EOL), write aggregator checks that pass when jobs are skipped, use corepack enable on runners where corepack no longer ships, and emit workflows with unpinned actions and default-broad permissions.

When NOT to use

Release/publish workflows → node-release.
What the checks run (lint rules, test config) → node-lint / node-testing / node-typescript; this skill wires them.
Dependabot/dependency policy → node-supply-chain (but every workflow this skill emits complies with its pinning/permissions rules).

Workflow

Derive, don't hardcode: matrix from package.json#engines intersected with maintained Node lines (verify current LTS/EOL against the nodejs.org release schedule — table version-gated in references/ci-playbook.md). Optional next-Current line as allowed-failure.
Package manager from the lockfile: setup-node cache keyed to the right lockfile; pnpm via its setup action — do not rely on corepack on current runners (not bundled with newer Node lines; verified in the playbook).
Structure: lint / typecheck / test jobs → one fail-closed aggregator as the only required check: if: always() with an explicit result test that fails on failure, cancelled, and skipped (exact YAML in the playbook — a naive needs chain passes on skips).
Merge queues: every workflow backing a required check declares merge_group alongside pull_request, or the queue silently stalls.
Hygiene by construction: top-level permissions: contents: read, per-job elevation only; third-party actions SHA-pinned with version comment (official actions/* by major tag + Dependabot); concurrency with cancel-in-progress; timeout-minutes everywhere.
Speed work is measured work: read run timings first; then lockfile-keyed caching, matrix pruning, suite splitting — never delete gates for speed silently.
Verify:
```
python3 "${CLAUDE_SKILL_DIR}/scripts/check_workflows.py"
```
then push and confirm the aggregator turns red on a deliberately failed leg (prove fail-closed once).

Output spec

Workflows that pass schema validation and the checker script; matrix documented against engines; a single aggregator required check proven to fail on failed/cancelled/skipped legs; merge_group present when queues are on; no unpinned third-party actions; no default-broad permissions.

Gotchas

Required-check names match the reported check (job name:), not filenames — renames silently orphan branch rules.
A matrix leg that's skipped by path filters still satisfies naive aggregators — the playbook's result-check is the fix.
cancel-in-progress: true on main pushes can cancel deploy-adjacent runs — scope concurrency groups to refs deliberately.
Version-gate the LTS table and setup-action majors; re-verify at authoring time.

Files

references/ci-playbook.md — engines-derived matrices, cache/pnpm setup, fail-closed aggregator YAML, merge_group, monorepo filtering, remote cache.
scripts/check_workflows.py — static workflow audit (unpinned third-party actions, missing permissions, EOL node versions, aggregator/merge_group presence); non-zero exit on violations.